REDHAT-BUG-2556265: Medium severity redhat/iscsi-initiator-utils vulnerability

Summary: The DHCPv4 option parser in iscsiuio passes the total UDP payload length to parseoptions() instead of the options-only length, causing the parser to walk 240 bytes past the actual end of options data into adjacent heap memory.

Component affected: iscsi-initiator-utils (iscsiuio), iscsiuio/src/apps/dhcpc/dhcpc.c, parsemsg() (line 241) and parseoptions() (line 206).

Vulnerability Details:

parsemsg() at line 249 calls: parseoptions(s, &m->options[4], uipdatalen(s->ustack))

uipdatalen() returns the total UDP payload length, but &m->options[4] points 240 bytes into the DHCP message (236-byte struct dhcpmsg header + 4-byte magic cookie). The end pointer in parseoptions() (line 208: end = optptr + len) is therefore 240 bytes past the actual end of the options data.

Additionally, parseoptions() reads optptr[1] (option length byte) without verifying 2 bytes remain before end, and all memcpy calls use hardcoded 4-byte sizes without checking the option's declared length field.

This is distinct from CVE-2026-18728, which fixes an integer underflow in uipprocess() where uiplen wraps when IPv4 Total Length < 28. This bug is in parsemsg() itself — even with a correctly computed uiplen, the offset subtraction is missing.

Requirements to exploit: Adjacent-network access on the same L2 segment as a system running iscsiuio with IPv4 DHCP enabled. The attacker must spoof a DHCP reply matching the xid and chaddr from a prior DHCP discover (both observable on L2). No authentication or user interaction required.

Version affected: All versions including latest upstream master (a65ce4b). Confirmed unfixed via ASAN-instrumented build on RHEL 10.2 (iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el102.2) and upstream master.

Dynamic confirmation: ASAN SEGV in handledhcp → memcpy with OOB-derived pointer. Reproducible unit test provided.

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - 7.4 AV:A — L2-adjacent access required AC:L — standard DHCP spoofing PR:N / UI:N — no privileges or user interaction S:U — impact within iscsiuio's own security authority C:L — heap data leaks into network configuration I:L — attacker-influenced network config via heap data A:H — OOB read → SEGV crash confirmed; iSCSI-boot system loses connectivity

Proposed Fix: Subtract the DHCP message header size from the length passed to parseoptions: return parseoptions(s, &m->options[4], uipdatalen(s->ustack) - DHCPMSGLEN - 4);

Upstream status: No fix exists. CVE-2026-18728 does NOT cover this bug. Acknowledgement: Red Hat Product Security